Okta Access Token - SpringBoot

Questions OAuth/OIDC
,
1

Hi Team,

I am working on POC and following the spring boot okta documents.

I am able generate the access token from /default/v1/token.

While validating on https://www.jwt.io/, getting success validation and updating last character in access token from A-Z is also working for some of them.

Example: acess token ending with QUmueAPokhdkfAHfXOEuQgG6vTywh6q2q7WITRX0GUnESEfOcHnUAj0Vc6D4cGO7ZiYqZ32ROMNFpQ

If i will update last character Q to P OR Q to R or Q to Z then also valid token. May I know why it is happening. If any update in mid, error message is coming.

2

There was a similar question asked in the Auth0 Community: Altered JWT Still Validates - Auth0 Community

More details available in the readme for the jjwt library:

And there’s also this longer form article that explains why this happens: Decoding the JWT Anomaly: When Changing a Token’s Last Character Doesn’t Break Verification | by Markus Huber | Medium